iGet Sharp v1.1.2 iOS - Multiple Web Vulnerabilities

Document Title:
===============
iGet Sharp v1.1.2 iOS - Multiple Web Vulnerabilities


References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=991


Release Date:
=============
2013-06-29


Vulnerability Laboratory ID (VL-ID):
====================================
991


Common Vulnerability Scoring System:
====================================
6.5


Product & Service Introduction:
===============================
iGet Sharp is a powerful tool to download and share files app which allows you to download free legal music, videos,books, 
picture etc by your device, then effective management, view and share your downloaded files!

*specifically as follows:

*Download Management
** Built-in browser, automatically detect the download link
** download e-mail attachment, download via password validation
** Bookmark Support
** Download history
** Multiple simultaneous downloads,add download task Manually
** Interrupt and resume downloading at any time
** Live download progress bar and speed indicator

*File Sharing
** USB File Sharing via iTunes
** Http File Sharing via WiFi
** Email multiple files, folder Supported
** Open files using other applications

*File Manage
** New Folder
** Sorting by file name, create date and file type
** View, copy, move, delete, rename, email, zip Compression and unzip files/folders
** Glide deleting function
** Select all and Cancel all
** Photo import Supported
** Bookmark supported

*File View
** New plain text(default encoding UTF-8),Convert plain file encoding (Unicode,UTF-8 etc) [.txt]
** External file content copy or paste
** Photo View, Zoom [.png .jpg .jpeg .gif .bmp .xbm .tif .tiff etc];
** Document reader [.pdf .rtf .csv .rtfd .doc .docx .xls .xlsx .ppt .pptx (office 2003 or later) etc]
** Video Player [.mp4 flv,asf,rmvb,avi,mpg,mkv,wmv]
** File Compression and Decompression [.zip .rar]
** Multi-touch Supported, Zoom files
** Landscape mode supported
** iPad-compatible

(Copy of the Vendor Homepage: https://itunes.apple.com/de/app/iget-sharp+/id454162356 )


Abstract Advisory Information:
==============================
The Vulnerability Laboratory Research Team discovered multiple vulnerabilities in the iGet Sharp v1.1.2 apple iOS application.


Vulnerability Disclosure Timeline:
==================================
2013-06-30:	Public Disclosure (Vulnerability Laboratory)


Discovery Status:
=================
Published


Affected Product(s):
====================
Apple AppStore
Product: iGet Sharp - Mobile Application 1.1.2


Exploitation Technique:
=======================
Remote


Severity Level:
===============
Medium


Technical Details & Description:
================================
1.1
A local file include and arbitrary file upload web vulnerability via POST method request is detected in the iGet Sharp v1.1.2 apple iOS application.
The vulnerability allows remote attackers via POST method to upload files with multiple extensions to unauthorized access them on application-side of the service.

The vulnerability is located in the upload file module of the web-server (http://localhost:41492/) when processing to request a manipulated 
filename via POST. The execution of the injected path or file request will occur when the attacker/target is processing to reload to index listing 
of the affected module. Remote attackers can exchange the filename with a tripple extension to bypass the filter and can execute the files located 
on the little web-server of the application.

Exploitation of the vulnerability requires no user interaction and also without privilege application user account (no password standard).
Successful exploitation of the vulnerability results in unauthorized path or file access via local file include or arbitrary file upload.

Vulnerable Application(s):
				[+] iGet Sharp v1.1.2 - ITunes or AppStore (Apple)

Vulnerable Module(s):
				[+] File Upload  (Web Server) [Remote]

Vulnerable Parameter(s):
				[+] filename as resource
				[+] file extensions (multiple)

Affected Module(s):
				[+] iGet Sharp File Index Listing


1.2
A persistent input validation web vulnerability is detected in the iGet Sharp v1.1.2 apple iOS application.
The bug allows an attacker (remote) to implement/inject malicious script code on the application-side (persistent) of the app web service. 

The vulnerability is located in the index file dir listing module of the web-server (http://localhost:41492/filename) when processing to 
display via POST request method injected manipulated `Path & File Names`. The persistent script code will be executed in the main index file dir 
listing module when the service is processing to list the new malicious injected file & path names as item.

Exploitation of the persistent web vulnerability requires low or medium user interaction without application user account.
Successful exploitation of the vulnerability can lead to persistent session hijacking (customers), account steal via persistent web 
attacks, persistent phishing or stable (persistent) certificate mail notification context manipulation.

Vulnerable Application(s):
				[+] iGet Sharp v1.1.2 - ITunes or AppStore (Apple)

Vulnerable Module(s):
				[+] Add File

Vulnerable Parameter(s):
				[+] path name
				[+] file name

Affected Module(s):
				[+] iGet Sharp File Index Listing


Proof of Concept (PoC):
=======================
1.1
The arbitrary file upload web vulnerability and extension filter issue can be exploited by remote attackers without privilege application 
user account and also without required user interaction. For demonstration or reproduce ...

21:26:18.956[0ms][total 0ms] Status: pending[]
POST http://localhost:41492/?upload=true&guid=9A0A7235-3AEF-442A-B589-9B2D292207F3 
Load Flags[LOAD_BYPASS_CACHE  ] Content Size[unknown] Mime Type[unknown]
   Request Headers:
      Host[localhost:41492]
      
User-Agent[Mozilla/5.0 (Windows NT 6.1; WOW64; rv:21.0) Gecko/20100101 Firefox/21.0]
      
Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
      Accept-Language[en-US,en;q=0.5]
      
Accept-Encoding[gzip, deflate]
      DNT[1]
      If-Modified-Since[Mon, 26 Jul 1997 05:00:00 GMT]
      Cache-Control[no-cache]
      
X-Requested-With[XMLHttpRequest]
      X-File-Name[327.png]
      X-File-Size[27920]
      Content-Type[multipart/form-data]
      
Referer[http://localhost:41492/]
      Content-Length[27920]
   Post Data:
      POST_DATA[ÿØÿà




1.2
The persistent input validation web vulnerabilities can be exploited by remote attackers without privilege application user account and 
with low or medium required user interaction. For demonstration or reproduce ...

1.2.1
<tbody id="filelist"><tr class="shadow"><td colspan="5"><a href="javascript:void(0);" onclick="loadData('/?goback')" 
class="file"><span style="vertical-align:middle;"><img src="iGet%20Sharp-1_files/Folder.png" style="border:0;vertical-align:middle" 
;=""></span><span style="font-weight:bold;font-size:14px;">Downloads \..[PERSISTENT INJECTED SCRIPT CODE AS PATHNAME]</span></a></td></tr>
<tr><td><input name="chxItem" value="Untitle.html" onclick="selChkItem(this)" type="checkbox"></td><td><a href="http://localhost:41492/1337-ben.html" 
class="file">Untitle.html</a></td><td>79.93K</td><td>2013-06-27 21:23:55</td><td class="del"><input name="commit" 
value="Delete" onclick="DelegateData('/Untitle.html','8A4BC000-328D-49AC-903A-BEF2D96BB559');" class="button" 
type="button"></td></tr><tr><td colspan="5"><span class="total">1 items</span></td></tr></tbody>

1.2.2
<tbody id="filelist"><tr class="shadow"><td colspan="5"><a href="javascript:void(0);" onclick="loadData('/?goback')" 
class="file"><span style="vertical-align:middle;"><img src="iGet%20Sharp-1_files/Folder.png" style="border:0;vertical-align:middle" 
;=""></span><span style="font-weight:bold;font-size:14px;">Downloads \..</span></a></td></tr>
<tr><td><input name="chxItem" value="Untitle.html" onclick="selChkItem(this)" type="checkbox"></td>
<td><a href="http://localhost:41492/[PERSISTENT INJECTED SCRIPT CODE AS FILENAME].html" 
class="file">Untitle.html</a></td><td>79.93K</td><td>2013-06-27 21:23:55</td><td class="del"><input name="commit" 
value="Delete" onclick="DelegateData('/Untitle.html','8A4BC000-328D-49AC-903A-BEF2D96BB559');" class="button" 
type="button"></td></tr><tr><td colspan="5"><span class="total">1 items</span></td></tr></tbody>


Security Risk:
==============
1.1
The security risk of the arbitrary file upload vulnerability and the multiple extensions issue are estimated as high(+).

1.2
The security risk of the persistent input validation web vulnerability is estimated as medium(+).


Credits & Authors:
==================
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri ([email protected])


Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties, 
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business 
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some 
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation 
may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases 
or trade with fraud/stolen material.

Domains:    www.vulnerability-lab.com   	- www.vuln-lab.com			       - www.vulnerability-lab.com/register
Contact:    [email protected] 	- [email protected] 	       - [email protected]
Section:    video.vulnerability-lab.com 	- forum.vulnerability-lab.com 		       - news.vulnerability-lab.com
Social:	    twitter.com/#!/vuln_lab 		- facebook.com/VulnerabilityLab 	       - youtube.com/user/vulnerability0lab
Feeds:	    vulnerability-lab.com/rss/rss.php	- vulnerability-lab.com/rss/rss_upcoming.php   - vulnerability-lab.com/rss/rss_news.php

Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. 
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other 
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and 
other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), 
modify, use or edit our material contact ([email protected] or [email protected]) to get a permission.

    				   	Copyright © 2013 | Vulnerability Laboratory